Federal prosecutors say a Maryland man who stole more than $54 million from a crypto exchange blew a significant portion of the money on Pokémon cards, antique Roman coins, and a scrap of fabric from the Wright brothers’ plane. A Hacker With An Unusual Shopping List Jonathan Spalletta surrendered to authorities Monday after the US Attorney’s Office for the Southern District of New York unsealed an indictment against him. Agents who searched his home found the collectibles. The items were seized. Spalletta now faces up to 30 years in prison if convicted on all charges — one count of computer fraud and one count of money laundering. The case centers on two separate attacks against Uranium Finance, a now-defunct crypto exchange that operated on the BNB blockchain. Both hacks happened in April 2021, just weeks apart, and together they wiped out tens of millions of dollars in user funds. The platform never recovered. “Stealing from a crypto exchange is stealing – the claim that ‘crypto is different’ does not chang that,’” said U.S. Attorney Jay Clayton. “For the victims, there is nothing different about having your money taken.” https://t.co/jSaPJ0F5LR pic.twitter.com/TbQ1mLfOYp — US Attorney SDNY (@SDNYnews) March 30, 2026 The first attack, on April 8, was relatively minor by crypto-crime standards. A bad actor exploited a smart contract flaw and walked away with $1.4 million. The two sides eventually reached a private agreement, and all but $386,000 was returned. Then, 20 days later, Spalletta allegedly came back for more. The Second Strike Killed The Platform The April 28 attack was on another level. According to prosecutors, Spalletta exploited a coding error in Uranium Finance’s withdrawal system, hitting 26 separate liquidity pools in a single sweep. He made off with $53.3 million in Bitcoin, Ether, and the platform’s own U92 token. The exchange shut down shortly after. Victims were left with little information and no recourse. Uranium Finance had launched just days before the first hack, during the 2021 bull market. It was built as a fork of Uniswap, a well-known automated trading protocol. The platform never got a chance to grow. By the end of April, it was gone. Federal investigators worked the case for years behind the scenes. In early 2025, authorities recovered $31 million in cryptocurrency tied to the hack but offered no public explanation at the time. Monday’s indictment filled in the details. US Attorney Draws A Hard Line On Crypto Theft US Attorney Jay Clayton made clear his office views crypto theft the same as any other financial crime. “Stealing from a crypto exchange is stealing,” Clayton said. “For the victims, there is nothing different about having your money taken.” He added that Spalletta caused real losses for real people and is now under real arrest. Spalletta appeared before US Magistrate Ona Wang on Monday to formally hear the charges. Data from the broader crypto industry puts the 2021 hack in context — bad actors stole an estimated $2.6 billion through various exploits that year alone. The biggest was a $610 million breach of the Poly Network, though the hacker in that case eventually returned the funds. The Uranium Finance victims have waited nearly five years for answers. Monday’s indictment was a start. Featured image from Unsplash, chart from TradingView
